Unlocked Secrets: How Leaked Credentials Fuel Bug Bounties

Hey there! It’s cyberpro151 back with another writeup about a finding for which I’ve got a lot of requests for writeup. In this writeup, I would like to discuss about how you can find leaked credentials that can lead to some great bounties and can give you a chance to test those assets that are password protected and you cannot register on those assets.

For finding leaked credentials, I personally use Osintleak. Visit following URL to use this site: https://osintleak.com/.

In order to use this site completely, you’ll have to buy it’s subscription by going to following URL: https://osintleak.com/dashboard/profile and then clicking on “Subscription” plan. It costs hundred dollars per month. In free plan, you can only find leaked credentials based on username, Name, First Name, Last Name,email and password but after paying subscription, you can find credentials based on every option present on the site and along with that, you can also download these leaked credentials.

Now, I’ll share how I was able to find mass admin accounts on a target. So right after finding the site of the target which was like following:
https://admin.connect.redacted.com

I quickly copied the URL and after logging in to Osintleak, I went to following URL:
https://osintleak.com/dashboard/search

Then I selected URL option as I have shown in the screenshot below:

Then I simply entered the URL in the searchbar and searched for the leaked credentials and bingo! almost all credentials of that site were getting leaked and were valid too. The response was something like following

Now I tried to login using these credentials and got access to more than 10 admin accounts. I simply wrote a report and reported it to the company and within 5–6 hours, my report was accepted and resolved too as you can see in screenshot below:

Not only that! I got 2 more admin panels as you can see in screenshot below using same tool as you can see below

Thus, it is the easiest critical bug you can find.

Thanks for reading and don’t forget to give me review on my article, give some claps if you like it and also make sure to follow me on twitter with username cyberpro151

Take care! Bubyee! ❤